CVE-2024-5133

In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, when a user initiates the password reset process, the recovery token is included in the response of the `GET /v1/users/me/org` endpoint, which lists all users in a team. This allows any authenticated user to capture the recovery token of another user and subsequently change that user's password without consent, effectively taking over the account. The issue lies in the inclusion of the `recovery_token` attribute in the users object returned by the API.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://huntr.com/bounties/6057598d-93c4-4a94-bb80-5bd508013c5b

Configurations

No configuration.

History

No history.

Information

Published : 2024-06-06 19:16

Updated : 2024-06-07 14:56

NVD link : CVE-2024-5133

Mitre link : CVE-2024-5133

CVE.ORG link : CVE-2024-5133

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2024-5133", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2024-06-06T19:16:05.557", "references": [{"url": "https://huntr.com/bounties/6057598d-93c4-4a94-bb80-5bd508013c5b", "source": "security@huntr.dev"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, when a user initiates the password reset process, the recovery token is included in the response of the `GET /v1/users/me/org` endpoint, which lists all users in a team. This allows any authenticated user to capture the recovery token of another user and subsequently change that user's password without consent, effectively taking over the account. The issue lies in the inclusion of the `recovery_token` attribute in the users object returned by the API."}, {"lang": "es", "value": "En lunary-ai/lunary versi\u00f3n 1.2.4, existe una vulnerabilidad de apropiaci\u00f3n de cuenta debido a la exposici\u00f3n de tokens de recuperaci\u00f3n de contrase\u00f1a en las respuestas de API. Espec\u00edficamente, cuando un usuario inicia el proceso de restablecimiento de contrase\u00f1a, el token de recuperaci\u00f3n se incluye en la respuesta del endpoint `GET /v1/users/me/org`, que enumera todos los usuarios de un equipo. Esto permite que cualquier usuario autenticado capture el token de recuperaci\u00f3n de otro usuario y posteriormente cambie la contrase\u00f1a de ese usuario sin consentimiento, asumiendo efectivamente el control de la cuenta. El problema radica en la inclusi\u00f3n del atributo `recovery_token` en el objeto de usuario devuelto por la API."}], "lastModified": "2024-06-07T14:56:05.647", "sourceIdentifier": "security@huntr.dev"}